Except this greatly weakens key pinning because now anyone that controls a CA cert can get you on first visit from a new browser/profile/cleared private data/device.